CVE-2018-0860: Microsoft Edge and ChakraCore scripting engine out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS percentile make this a realistic remote code execution risk despite the high attack complexity and required user interaction.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, producing an out-of-bounds write (CWE-787) that can corrupt memory. A remote attacker can leverage this to execute code in the context of the browser process. It affects Windows 10 (Gold, 1511, 1607, 1703, 1709) and Windows Server 2016.

Impact

Successful exploitation gives the attacker remote code execution at the privilege level of the affected Edge or ChakraCore process, enabling arbitrary code and potential further compromise of the host.

Attack surface

Reached over the network via a crafted web page or script processed by the Edge/ChakraCore scripting engine; no authentication is required but user interaction (visiting or opening the malicious content) is needed per the CVSS vector (AV:N/AC:H/PR:N/UI:R).

Exploitation

Not listed in CISA KEV, but a public Exploit-DB entry (44076) exists and EPSS is high (0.653, 99.2nd percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0860 as the first action.
• Upgrade or migrate off unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) to a supported release.
• Enforce browser hardening: disable or restrict legacy scripting features and keep Edge/ChakraCore patched.
• Block or filter known exploit delivery vectors at the network and email gateway where feasible.

Detection

• Monitor for Edge/ChakraCore process crashes or abnormal memory corruption events on endpoints.
• Hunt for known exploit artifacts and indicators tied to Exploit-DB 44076 in web proxy and endpoint logs.
• Alert on suspicious script or web content execution patterns targeting the scripting engine.
• Track patch compliance for the affected Windows 10 builds and Windows Server 2016.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.